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(i the costs of security measures: 
(iii) the need for training persons who have 
access. ; 
to A information: ; = 
(iv) the value of audit trails in 
comnuterized 
record svstems: and. 
"(v) the needs and capabilities of small health 
care 
nroviders and rural health care providers (as 
Suc 
providers are defined by the Secretary); and 
EN ensure that a health care clearinghouse, 
Wit7s 
vart. of a larger organization, has policies and 
security eee 8 pes 
nrocediires which isolate the activities of the 
health care : ; 
clearinahouse with respect to processing 
information in ; 
a mannerthat prevents unauthorized 
access) to such 
information bv suc raer oraanization. ; 
"(2.. SAFEGUARDS ach person’ described 
in section . ; ; 
1172(a) who maintains or transmits health 
information shall ; 
maintain reasonable and appropriate 
administrative. techni 
and physical safeguards— : 
"(A) to ensure the integrity and 
confidentiality of the 


(B) to veal against any reasonably 


nticinate . 

“(i) threats or hazards to the security or 

intearitv 

of the information: and 

(ii) unauthorized uses- or 

disclosures of the 

information: and ; ; 
_£(C) otherwise to ensure compliance with 

this nart. 


v the officers and emnlov of such person#® 
(e) VEC mROMTS SIGNATURE = 
1) e 


STANDARDS Secretarv. in 
coordination wit. the 
Secretarv of Commerce! shall adont standards 
snecifvina nroce- 
dures for the electronic transmission = and 
authentication of 
sianatures with resnect to the transactions 
referred to in sub- 


section (a)(1). 
"(2.) REFECT OF COMPTIANCEL&G@omnliance with the stand- 
ards adonted under naraaranh (1) shall be deemed to satisfv 
Federal and State statutorv reauirements for written siaqnatiures 
with reget to the transactions referred in sihsection (a). 
(€) TRANSFER_OF INFORMATION AMONG HFATTH PT.ANS he 
Secretary shall adopt standards for transferring among EAD 
nlans 
appropriate standard data elements needed for the 
; ; _ coordination 
of benefits, the sequential processing of claims, and ol ner 


ata 
elements for individuals who hav@ more than one health plan. 
"TIMETABLES FOR ADOPTION OF STANDARDS 
42)USC 1320d@3. "SEC. 1174. (a) INITIAL STANDARDS{==The Secretary 


shall carry 


out section 1173 not later than 18 months after the 
date of the 

enactment. of the Health Insurance Portability and 
Accountability 

Act. of 1996. except that standards relating to claims 
attachments 

satel adopted not later than 30 months after such 


) AD a AND MODIFIC NS TO STANDARDS 


IN. GENERAT, xcent as ovrovided in 
ee 
the Secretarv shall review the standards adonted 
unde section 
11734 and_ shall adont modifications to the 
standards (includina 
additions to the standards)! as determined 
avvronvriate. but 
not more freauentlv than once everv 12 months. 
Anv addition 
or modification to a standard shall be comnleted in 


a. ot . . manner 
which minimizes the disruption and cost of 
compliance. 


